Windows server 2003 Zone transfer configuration reccomendations anyone?

Posted on 2009-02-24
Last Modified: 2012-06-27
Hello all,
we have a 3 subdomain environment as follows: - root dc (does very little) ! - central services (the core servers at the datacentre) - sites (end users across uk/europe/america)

I am a little dubious about the configuration that we have regarding zone transfers for our subnets...

All of gc3 appears to be absolutely fine - 1 x reverse lookup zone per site with zone transfers enabled to each server in the name servers tab.  The name servers tab is populated with gc3 servers only

In the CS domain, I do not have all the reverse lookup zones added that exist in the gc3 domain - I do, however randomly have some that have been added.  Although I have not idea why - or whether they should all be added from the domain

Each site has its own local DNS server holding a copy of the zone, and a copy of all the reverse lookup zones for that domain

Clients on site at any location need to be able to resolve any machine - which they are able to via the forwarders configuration within DNS central servers need to be able to resolve all machines

When I look at the reverse lookup zones in the domain that HAVE alrready been added, zone transfers are disabled

When I look at the same reverse lookup zones in they are all enabled (by me) and working

I'm at a bit of a loss as to what reverse lookup zones should be added in and what zone transfers should be allowed between where

The authorative DNS servers for each domain are as follows: (root DC for gc3.cs.gcg,net) (DC1 for (Root DC for

All advice greatly appreciated...
Question by:Greencore
    1 Comment
    LVL 70

    Accepted Solution


    Hey :)

    I would move away from Zone Transfers as a mechanism for distributing this personally.

    I would do the following: - Change the replication scope to "All DNS Servers in the AD Forest" - Add a Delegation for, delegation to include all DNS servers hosting the zone - Ensure Replication is set to "All DNS Servers in the AD Domain"

    So far that meets the requirements for host name resolution from parent domain to child domain and vice versa. The costs of replication of the zone to the entire forest can be tweaked by increasing the No-Refresh interval to reduce the rate of change if necessary.

    Reverse lookups are a bit more complex because you have a higher number of sub-domains (subnets) than with forward lookup. That makes the delegation model complex at best (because it only follows classful IP ranges).

    Potential options are:

    1. One Reverse Lookup Zone

    a. Configure a single Reverse Lookup Zone that covers all subnets within the Forest.
    b. Set the zone to replicate to "All DNS Servers in the AD Forest".

    If rate of change is high that may place more of a burden on replication traffic than is desirable.

    2. One parent with delegated children

    a. Configure a parent zone at, e.g.
    b. Set the zone to replicate to "All DNS Servers in the AD Forest".
    c. Configure a delegation for each child subnet (e.g.

    Both methods allow global resolution of all IP addresses. One carries a higher replication cost, the other a higher administrative cost (maintaining delegations).

    If I think of any more I'll be sure to pop them in :)


    Featured Post

    Enabling OSINT in Activity Based Intelligence

    Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

    Join & Write a Comment

    This may not be a text book method to resolve VSS backup issues but it seemed to have worked on few of the Windows 2003 servers we had issues while performing a Volume Shadow Copy backup. If you have issues while performing a shadow copy backup usin…
    One of the most often confused topics in the area DNS is the idea of GLUE records. Specifically, what they are, when they are needed, when they are provided, and how they are created. First, WHAT IS GLUE? To understand GLUE, you must first under…
    Need more eyes on your posted question? Go ahead and follow the quick steps in this video to learn how to Request Attention to your question. *Log into your Experts Exchange account *Find the question you want to Request Attention for *Go to the e…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now